AWS Secrets Manager fetcher
+ AWS IAMAWS IAM fetcher for IAM users, roles, groups, and policies
@@ -4368,6 +4378,67 @@Optional resource discovery configuration
+If not specified, resource discovery is disabled
Configuration for AWS resource discovery
+ +Resource discovery fetches actual AWS resources (S3 buckets, EC2 instances, etc.)
+to match against IAM policy ResourceSelectors and create GrantsAccessTo edges.
If resource_discovery is not specified in config, resource discovery is disabled.
# Enable resource discovery for all supported services
+[sources.aws-iam.resource_discovery]
+enabled = true
+
+# Enable but exclude specific services (performance optimization)
+[sources.aws-iam.resource_discovery]
+enabled = true
+exclude_services = ["ec2"] # EC2 has too many instances
+"awssecretsmanager"
-
-
-
-
-
-
- Enable resource discovery
- - -Authentication method for GCP
-If not specified, defaults to Application Default Credentials
Use a service account key file for authentication
+ exclude_servicesServices to exclude from resource discovery (opt-out model)
+If not specified, all supported services will be fetched.
+Example: ["ec2", "lambda"] to skip EC2 and Lambda resources
Use Kubernetes API to get service account tokens and authenticate via WIF.
-This is the most secure and cloud-native authentication method.
"awsiam"
+
+
+
+
+
+
+ Custom audience for the WIF provider. If not specified, defaults to the standard
-WIF provider URL format: //iam.googleapis.com/projects/{projectnumber}/locations/global/workloadIdentityPools/{poolid}/providers/{provider_id}
AWS Secrets Manager fetcher
+ + -"k8s"
-
-
-
-
-
-
- Google Service Account name (without @project.iam.gserviceaccount.com)
- - - - - - - -Declare an environment
+Same definition as sources_additionalProperties_oneOf_i0_env_anyOf_i0 +null
+
+
+
+
+
+
+ Kubernetes service account name to use for authentication
- - - - - - - -GCP Project ID where the service account is located
- - - - - - - -The mode gives an additional layer of permissions allowing to configure a Scout instance, giving read-only, write-only, or read and write permissions to that source. Default is read-only.
+ +Token expiration time in seconds. Default to 30 minutes
- + regionsThis will infer its configuration based on its environment.
-Works with the GOOGLEAPPLICATIONCREDENTIALS environment variable
-or by automatically calling GCP's metadata endpoint (if run as a GCE or GKE workload).
"awssecretsmanager"
+
+
+
+
+
+
+ GCP Secret Manager fetcher
+ - -Authentication method for GCP
+If not specified, defaults to Application Default Credentials
Declare an environment
-Same definition as sources_additionalProperties_oneOf_i0_env_anyOf_i0 -Use a service account key file for authentication
+ + + + + + + +null
-
-
-
-
-
-
- "service_account_key_file"
@@ -6730,18 +6719,18 @@ Use Kubernetes API to get service account tokens and authenticate via WIF.
+This is the most secure and cloud-native authentication method.
Custom audience for the WIF provider. If not specified, defaults to the standard
+WIF provider URL format: //iam.googleapis.com/projects/{projectnumber}/locations/global/workloadIdentityPools/{poolid}/providers/{provider_id}
"k8s"
- No Additional ItemsGoogle Service Account name (without @project.iam.gserviceaccount.com)
+ + + + + + +The mode gives an additional layer of permissions allowing to configure a Scout instance, giving read-only, write-only, or read and write permissions to that source. Default is read-only.
+ auth + + oneOf + + Kubernetes Workload Identity Federation + + kubernetes_namespaceKubernetes namespace where the service account is located
- -Kubernetes service account name to use for authentication
+ - No Additional ItemsWorkload Identity Pool ID
+ -"gcpsecretmanager"
-
-
-
-
-
-
- GCP Project ID where the service account is located
- - -GCP Project Number
+ + + + + + + +Declare an environment
-Same definition as sources_additionalProperties_oneOf_i0_env_anyOf_i0 -Workload Identity Provider ID
+ + + + + + + +null
-
-
-
-
-
-
- Token expiration time in seconds. Default to 30 minutes
+ @@ -7492,19 +7694,9 @@This will infer its configuration based on its environment.
+Works with the GOOGLEAPPLICATIONCREDENTIALS environment variable
+or by automatically calling GCP's metadata endpoint (if run as a GCE or GKE workload).
"default"
+
+
+
+
+
+
+ Declare an environment
+Same definition as sources_additionalProperties_oneOf_i0_env_anyOf_i0 +null
+
+
+
+
+
+
+ The mode gives an additional layer of permissions allowing to configure a Scout instance, giving read-only, write-only, or read and write permissions to that source. Default is read-only.
+ + +"gcpsecretmanager"
+
+
+
+
+
+
+ Azure Key Vault fetcher
+ + + + + + + + + +Declare an environment
+Same definition as sources_additionalProperties_oneOf_i0_env_anyOf_i0 +null
+
+
+
+
+
+
+ The mode gives an additional layer of permissions allowing to configure a Scout instance, giving read-only, write-only, or read and write permissions to that source. Default is read-only.
+ + +"azurekeyvault"
+
+
+
+
+
+
+ GitLab CI fetcher
+ + + + + + + + + +Declare an environment
+Same definition as sources_additionalProperties_oneOf_i0_env_anyOf_i0 +null
+
+
+
+
+
+
+ "gitlabci"
+
+
+
+
+
+
+ GitLab Personal Access Token fetcher
+ + + + + + + + + +Admin token needed for PAT API access (requires admin privileges)
+ @@ -7664,18 +10020,210 @@Environment designation for this configuration
+Declare an environment
+Same definition as sources_additionalProperties_oneOf_i0_env_anyOf_i0 +null
+
+
+
+
+
+
+ The mode gives an additional layer of permissions allowing to configure a Scout instance, giving read-only, write-only, or read and write permissions to that source. Default is read-only.
- + includeGitLab instance URL (e.g., "https://gitlab.com" or "https://gitlab.example.com")
+ @@ -7903,18 +10496,18 @@"gitlabpat"
@@ -7965,7 +10558,7 @@ GitLab CI fetcher
+ Conjur CloudConjur Cloud fetcher
@@ -8007,18 +10600,18 @@Declare an environment
-Same definition as sources_additionalProperties_oneOf_i0_env_anyOf_i0 -CyberArk client ID or Conjur workload Client ID
+ @@ -8198,18 +10816,18 @@Secret for authenticating
+ - No Additional Items"cyber_ark"
- No Additional Items"workload"
@@ -8604,7 +11376,7 @@ GitLab Personal Access Token fetcher
- + item 8 + + auth + + oneOf + + Kubernetes authenticationAdmin token needed for PAT API access (requires admin privileges)
- + auth + + oneOf + + Kubernetes authentication + + auth_mode"k8s"
@@ -8708,18 +11518,18 @@ Optional Host ID for the K8s authenticator
+ + + + + + + +Environment designation for this configuration
-Kubernetes namespace where service account is defined
+ + + + + + + +Declare an environment
-Same definition as sources_additionalProperties_oneOf_i0_env_anyOf_i0 -null
-
-
-
-
-
-
- Kubernetes service account used for authentication
+ @@ -8900,18 +11767,18 @@Service ID for the K8s authenticator
+ - No Additional ItemsToken expiration time in seconds. Default to 30 minutes
+ + + + + + + +Declare an environment
+Same definition as sources_additionalProperties_oneOf_i0_env_anyOf_i0 +GitLab instance URL (e.g., "https://gitlab.com" or "https://gitlab.example.com")
- + item 1null
+
+
+
+
+
+
+ Conjur Cloud fetcher
- - - - - - - - - -Type: objectThe mode gives an additional layer of permissions allowing to configure a Scout instance, giving read-only, write-only, or read and write permissions to that source. Default is read-only.
+ +"conjurcloud"
@@ -9753,7 +12608,7 @@ Conjur fetcher (supports both OSS and Enterprise)
+ -Secret for authenticating
@@ -9981,18 +12788,18 @@"user"
-API key for authenticating
@@ -10289,18 +13070,18 @@Login (including host/ in case of a workload)
@@ -10372,18 +13146,18 @@"api"
@@ -10455,18 +13221,25 @@ Token expiration time in seconds. Default to 30 minutes
- - - - - + accountThe mode gives an additional layer of permissions allowing to configure a Scout instance, giving read-only, write-only, or read and write permissions to that source. Default is read-only.
@@ -11173,18 +13891,18 @@"conjur"
@@ -11296,7 +14014,7 @@ Akeyless fetcher
@@ -11340,18 +14058,18 @@Akeyless API v2 URL. Default to https://api.akeyless.io/.
If you use an Akeyless Gateway, you must use the complete URL. Example: https://my-akeyless-gw.com/api/v2/
The mode gives an additional layer of permissions allowing to configure a Scout instance, giving read-only, write-only, or read and write permissions to that source. Default is read-only.
@@ -12134,18 +14852,18 @@"apikey"
@@ -12195,18 +14913,18 @@ "akeyless"
@@ -12257,7 +14975,7 @@ Delinea SecretServer fetcher
@@ -12301,18 +15019,18 @@The mode gives an additional layer of permissions allowing to configure a Scout instance, giving read-only, write-only, or read and write permissions to that source. Default is read-only.
@@ -12903,18 +15621,18 @@Top-level domain
This can be found by clicking on "Token API documentation" in the Settings > REST API section of the Secret Server UI